36002fb92e38a01f7471fb0e2e2e8d4573dc04c8fe7ee75c65540762dad0d2d4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uranium-235.exe
Size

1.5MB
MD5

9b9db745ae002a2ae05a43f60dc5898d
SHA1

e29aba2000e05bb20d972661a45623d928e3239c
SHA256

36002fb92e38a01f7471fb0e2e2e8d4573dc04c8fe7ee75c65540762dad0d2d4
SHA512

c6a51ffe6d6169d30c584c630bf4016d7055ec240a724517750f5e4b209dad62ca22a003b5d9e8805bff6134574d9f81ba8c29aadb27e27b2fab198409648024
SSDEEP

24576:84nXu/QSDTV+Bnvu8tJgbxkDq1SvYlVyi6wp79tUkMDmbsgBnK3HJAMmJsDEyX:8qeNVfXYYqi6e79tUkM4sgBnKXJA/y

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uranium Security.lnk	Uranium-235.tmp

Executes dropped EXE 2 IoCs

pid	Process
2688	Uranium-235.tmp
2772	Uranium-235.tmp

Loads dropped DLL 4 IoCs

pid	Process
2240	Uranium-235.exe
2688	Uranium-235.tmp
2744	Uranium-235.exe
2772	Uranium-235.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	Uranium-235.tmp

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2240 wrote to memory of 2688	2240	Uranium-235.exe	28
PID 2688 wrote to memory of 2744	2688	Uranium-235.tmp	29
PID 2688 wrote to memory of 2744	2688	Uranium-235.tmp	29
PID 2688 wrote to memory of 2744	2688	Uranium-235.tmp	29
PID 2688 wrote to memory of 2744	2688	Uranium-235.tmp	29
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30
PID 2744 wrote to memory of 2772	2744	Uranium-235.exe	30

C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe
"C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\is-GKF24.tmp\Uranium-235.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GKF24.tmp\Uranium-235.tmp" /SL5="$7011E,870144,780800,C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe
    "C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe" /verysilent /sp-
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\is-JALER.tmp\Uranium-235.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JALER.tmp\Uranium-235.tmp" /SL5="$7011A,870144,780800,C:\Users\Admin\AppData\Local\Temp\Uranium-235.exe" /verysilent /sp-
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-JALER.tmp\Uranium-235.tmp

Filesize
2.5MB

MD5
89ee4bb1aa0c781baddb9007ad753af3

SHA1
3e6fd6adb92667c6b509bff6bd7e2d491f623d29

SHA256
79bac4c27a7c10dc14db471b09ce1e528ef2df3c249ef0b25b4090d4ba9bd20e

SHA512
dc8032bf7314b552bacf886c28e8d623bacee5e4967e59269179d4b9bf67a90d79883b01a4cbb2b0624a37f54feea5a836aa5f875566f59d2b15f15935811b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPMUE.tmp\idp.dll

Filesize
228KB

MD5
9a83f220bf8ca569e3cfa654539a47a4

SHA1
9d1fb7087c12512d5f66d9d75f2fbae8e1196544

SHA256
b1c4c9b2dd6a40974fa8789b218b52d967f5ccd1b47e95b4f6bda4b6ce864d0d

SHA512
9b6460aca9720a4762a28e78a0e5f3e7358f73383926caf7f4a071e66c79f1032abd131432387f108de27894c147e2f34f01b094b6688826ce78f007d9dafbc5

Download Submit
memory/2240-32-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2240-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2240-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2688-19-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/2688-9-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/2744-17-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2744-39-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2772-37-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download